Analysis Details netd Linux Backdoor’s RC4 C2 and Shell Capabilities
Summary
The analysis details netd, a statically linked Linux backdoor with an encrypted configuration, custom RC4 C2 protocol, interactive shell, and file-transfer commands. A Mach-O variant named ChromeUpdates was also observed on VirusTotal.
Key points
- The analyzed archive, out_linux.tar, contains a 64-bit ELF backdoor named netd and an encrypted 810-byte configuration file, netd.lck.
- The backdoor decrypts its configuration with XOR, resolves dynamic-DNS C2 domains, and XOR-decrypts the returned IP address.
- C2 communication uses a custom RC4-encrypted challenge–response over TCP/443; the malware sends system information before handling commands.
- Commands support an interactive shell, file upload and download, command execution, directory and process listing, process termination, configuration updates, and self-deletion.
- A named semaphore limits repeated execution, but the article says this check can be bypassed with a skip argument.
- The author did not interact with the decrypted IP address and could not confirm it was an active C2; a Mach-O sample named ChromeUpdates was also found on VirusTotal.
Article Details
- Attack Vectors
- The netd backdoor communicates with its C2 over TCP/443 using a custom RC4-encrypted challenge–response protocol and dynamic-DNS domains.
- The backdoor supports operator-directed shell commands and an interactive shell, as well as file uploads and downloads.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | chopaw[.]camdvr[.]org | Dynamic-DNS C2 domain listed in the backdoor's encrypted configuration. |
| DOMAIN | drawpin[.]accesscam[.]org | Dynamic-DNS C2 domain listed in the backdoor's encrypted configuration. |
| DOMAIN | mefng[.]giize[.]com | Default hard-coded C2 domain used by the backdoor. |
| SHA256 | 78e145fcc9f099a1dec49f9001bfbb06366fcf30f66a7cc9e6605b36019dfac4 | Hash of netd.lck, the encrypted configuration file used by the backdoor. |
| SHA256 | 8e4f33722c16a5e922a81a4be61db804bbf2e899d89902085e854b7f0a0d587f | Hash of out_linux.tar, the archive containing the backdoor and its encrypted configuration. |
| SHA256 | bcffe674c4425634d4750bb21a505be9ce35e31413d2e6cce75ad0c609563cc5 | Hash of the ChromeUpdates Mach-O backdoor sample observed on VirusTotal. |
| SHA256 | be0f36ee071a9c0c200dcdaed98fce7fadc31305d0a5f24a244a3af7833d21dd | Hash of the netd Linux backdoor. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe backdoor can send victim files and system information to the operator through its encrypted C2 channel.T1057 · Process DiscoveryThe backdoor implements a process-list command using ps -eo pid,ppid,command.T1059.004 · Unix ShellThe backdoor spawns an interactive Unix shell through a PTY and can execute operator-supplied shell commands.T1070.004 · File DeletionOn command, the backdoor removes itself and its configuration file.T1071.001 · Web ProtocolsThe backdoor uses a custom RC4-encrypted C2 protocol with a challenge–response handshake over TCP/443.T1071.004 · DNSThe backdoor makes DNS requests to resolve its C2 domains and retrieve an IP address that it XOR-decrypts.T1082 · System Information DiscoveryThe backdoor sends system information, including hostname and utsname fields, to the C2.T1105 · Ingress Tool TransferThe backdoor supports C2-directed file uploads to the victim and downloads from the victim.